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Chemical  Facility  Security:  Regulation  and  Issues  for 

Congress 


Summary 

The  Department  of  Homeland  Security  (DHS)  has  proposed  security  regulations 
for  chemical  facilities,  implementing  the  statutory  authority  granted  in  the  Homeland 
Security  Appropriations  Act,  2007  (P.L.  109-295,  Section  550).  The  proposed 
regulations  (71  Federal  Register  78,276-78,332  (December  28,  2006))  require 
chemical  facilities  possessing  amounts  and  types  of  substances  considered  by  the 
DHS  Secretary  to  be  hazardous  to  notify  DHS  and  undergo  a  consequence-based 
screening  process.  The  Secretary  would  then  determine  what  chemical  facilities  are 
high-risk,  and  thus  need  to  comply  with  additional  security  requirements.  The 
proposed  security  requirements  would  be  performance-based,  rather  than 
prescriptive,  and  tiered,  with  facilities  in  higher  tiers  having  more  stringent 
requirements  than  those  in  lower  tiers. 

High-risk  chemical  facilities  will  be  required  to  create  and  submit  to  DHS  a 
vulnerability  assessment;  create  and  submit  to  DHS  a  site  security  plan,  addressing 
the  vulnerability  assessment  and  complying  with  the  performance-based  standards; 
and  implement  the  site  security  plan  at  the  chemical  facility.  The  DHS  Secretary  will 
approve  or  disapprove  each  step  in  the  process,  requiring  the  chemical  facility  to 
improve  the  facility  submission  or  implementation  in  the  case  of  disapproval. 

The  proposed  security  regulations  also  establish  a  new  category  of  protected 
information,  Chemical-terrorism  Security  and  Vulnerability  Information  (CVI), 
granting  it  a  status  between  sensitive  but  unclassified  and  classified  information.  The 
Secretary  maintains  discretion  over  who  will  gain  access  to  this  information,  how  it 
may  be  used,  and  what  will  comprise  CVI.  Additionally,  the  proposed  security 
regulations  will  preempt  state  and  local  chemical  facility  security  regulations. 

Key  issues  debated  in  previous  Congresses  are  highlighted  in  the  proposed 
security  regulations,  even  when  the  enacted  authorizing  statute  remained  mute  on  the 
topic.  These  issues  include  what  facilities  should  be  considered  as  chemical 
facilities;  which  chemical  facilities  should  be  considered  as  “high-risk”  and  thus 
regulated;  the  scope  of  the  risk-based  performance  standards  for  different  tiers  of 
high-risk  chemical  facilities;  the  appropriateness  of  federal  preemption  of  existing 
state  chemical  facility  security  regulation;  and  the  availability  of  information  for 
public  comment,  potential  litigation,  and  congressional  oversight.  One  key  issue  not 
directly  addressed  by  the  regulation  is  the  role  of  inherently  safer  technology  in  the 
chemical  security  process. 

Policymakers,  as  well  as  the  general  public,  have  the  opportunity  to  comment 
in  support  of  or  in  opposition  to  the  proposed  regulation.  After  promulgation, 
Congress  might  disapprove  the  rule,  or  attempt  to  influence  implementation  through 
oversight  or  provisions  in  appropriations  language.  Since  the  statutory  authority  to 
regulate  chemical  facilities  expires  in  2009,  policymakers  may  wish  to  observe  the 
impact  of  the  current  regulations,  determine  their  effectiveness  and  efficiency,  and, 
if  necessary,  address  any  perceived  weaknesses  at  a  later  date  by  amending  or 
superseding  them  through  additional  legislation. 
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Chemical  Facility  Security:  Regulation  and 
Issues  for  Congress 


Introduction 

Chemical  facility  security  has  been  an  issue  of  congressional  interest  for  many 
years.  First  considered  an  environmental  issue,  the  potential  release  of  toxic 
chemicals  and  the  potential  health  impacts  on  surrounding  areas  became  linked  to 
concerns  over  terrorism  after  the  September  11,  2001  attacks  on  the  Wold  Trade 
Center  and  the  Pentagon.  The  passage  of  Section  550  of  the  Homeland  Security 
Appropriation  Act,  2007  (P.L.  109-295)  established  statutory  authority  for  the 
Department  of  Homeland  Security  (DHS)  to  regulate  select  chemical  facilities. 1  How 
DHS  implements  this  authority  will  likely  be  an  area  of  intense  congressional 
interest,  given  that  chemical  facility  security  legislation  was  introduced  in  each  of  the 
previous  four  Congresses  and  that  this  new  statutory  authority  expires  in  three  years.2 

Chemical  facility  security  authority  had  been  called  for  by  both  the  Executive 
and  Legislative  branches  for  many  years,  but  disagreements  about  how  chemical 
facilities  should  be  regulated  impeded  consensus.  The  potential  for  injuries  and 
fatalities  following  an  attack  on  a  chemical  facility,  as  well  the  value  of  the  chemical 
sector  to  the  national  economy,  led  many  security  experts  to  suggest  that  chemical 
facilities  were  high-value  targets  for  terrorists.  Chemical  facilities  were  considered 
a  key  component  to  securing  the  nation’s  critical  infrastructure.  The  passage  of  P.L. 
109-295  provided  DHS  with  chemical  facility  security  authority,  but  the 
implementation  of  this  authority,  the  effectiveness  of  promulgated  regulations,  and 
the  increase  in  homeland  security  are  all  yet  to  occur. 

This  report  will  describe  the  statutory  authority  granted  to  DHS  and  the 
regulations  proposed  by  DHS,  and  will  identify  select  issues  of  contention  related  to 
the  proposed  regulations.  Linally,  this  report  will  discuss  several  possible  policy 
options  for  Congress. 


1  Department  of  Homeland  Security  Appropriations  Act,  2007,  P.L.  109-295  §  550, 120  Stat. 
1355  (20006)  [hereinafter  DHS  Appropriations  Act].  See  also  71  Federal  Register 
78,276-78,332  (December  28,  2006). 

2  See  CRS  Report  RL31530,  Chemical  Facility  Security,  by  Linda-Jo  Schierow  (providing 
background  on  the  need  for  additional  security  measures,  security  enhancement  options,  and 
legislation  in  the  109th  Congress). 
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Authority  to  Regulate  Chemical  Facilities 

The  Homeland  Security  Appropriations  Act,  2007  (P.L.  109-295),  Section  550 
provides  statutory  authority  to  DHS  to  regulate,  for  security  purposes,  chemical 
facilities.  The  Secretary  of  Homeland  Security  is  directed  to  issue  interim  final 
regulations  establishing  risk-based  performance  standards  for  chemical  facility 
security  and,  requiring  the  development  of  vulnerability  assessments  and  the 
development  and  implementation  of  site  security  plans.3  These  regulations  are  to 
apply  only  to  those  chemical  facilities  that  the  Secretary  determines  present  high 
levels  of  security  risk.4  The  regulations  are  to  allow  regulated  entities  to  employ 
combinations  of  security  measures  to  meet  the  risk-based  performance  standards. 

Under  the  law,  the  Secretary  must  review  and  approve  the  required  assessment, 
plan,  and  implementation  for  each  facility.  The  Secretary  is  prohibited  from 
disapproving  a  site  security  plan  on  the  basis  of  the  presence  or  absence  of  a 
particular  security  measure,  but  may  disapprove  a  site  security  plan  that  does  not 
meet  the  risk-based  performance  standards.  The  Secretary  may  approve  vulnerability 
assessments  and  site  security  plans  developed  through  security  programs  not  created 
by  DHS,  so  long  as  the  results  of  these  programs  meet  the  risk-based  performance 
standards  laid  out  in  regulation. 

All  information  developed  for  these  regulations  is  to  be  protected  from  public 
disclosure,  but  may  be  shared,  at  the  Secretary’s  discretion,  with  state  and  local 
government  officials,  including  law  enforcement  officials  and  first  responders 
possessing  the  necessary  security  clearances.  Any  information  shared  may  not  be 
publicly  disclosed  pursuant  to  state  or  local  law.  Additionally,  the  information 
provided  to  the  Secretary,  along  with  related  vulnerability  information,  is  to  be 
treated  as  classified  information  in  all  judicial  and  administrative  proceedings. 
Violation  of  the  information  protection  provision  is  punishable  by  fine. 

The  Secretary  must  audit  and  inspect  chemical  facilities  and  determine 
regulatory  compliance.  If  the  Secretary  finds  a  facility  not  in  compliance,  the 
Secretary  shall  write  to  the  facility  explaining  the  deficiencies  found,  provide  an 
opportunity  for  the  facility  to  consult  with  the  Secretary,  and  issue  an  order  to  comply 
by  a  date  determined  by  the  Secretary.  If  the  facility  continues  to  be  out  of 
compliance,  the  Secretary  may  fine  and,  eventually,  order  the  facility  to  close. 

There  is  no  right  for  anyone,  except  the  Secretary  of  DHS,  to  bring  a  lawsuit 
against  a  facility  owner  to  enforce  provisions  of  the  law.  The  law  does  not  affect  any 
other  federal  law  regulating  chemicals  in  commerce.  The  statute  contains  a  “sunset 


3  These  interim  final  regulations  must  be  issued  within  six  months  of  the  date  of  enactment 
of  P.L.  109-295.  The  statutory  deadline  for  the  interim  final  regulations  is  April  4,  2007. 

4  Some  facilities  are  exempt  from  these  regulations.  They  are  facilities  defined  as  a  water 
system  or  a  wastewater  treatment  works;  facilities  owned  or  operated  by  the  Department  of 
Defense  or  Department  of  Energy;  facilities  regulated  by  the  Nuclear  Regulatory 
Commission;  and  those  facilities  regulated  under  the  Maritime  Transportation  Security  Act 
of  2002  (P.L.  107-295). 
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provision”  and,  thus,  expires  three  years  from  the  date  of  enactment,  which  was 
October  4,  2006. 


Proposed  Regulations  Issued  by  the  Department  of 

Homeland  Security 

On  December  28,  2006,  the  Department  of  Homeland  Security  issued  an 
advance  notice  of  rulemaking  regarding  chemical  facility  security.5  Proposed 
regulatory  language  implementing  P.L.  109-295  was  introduced  and  comments 
requested  from  stakeholders  and  the  public  by  February  7,  2007.  The  proposed 
regulation  implements  both  statutory  authority  explicit  in  P.L.  109-295  and 
authorities  DHS  found  to  be  implicitly  granted. 

The  proposed  regulations  state  that  the  Secretary  of  DHS  will  select  from  the 
universe  of  all  facilities  that  possess,  or  plan  to  possess  at  any  relevant  point  in  time, 
a  quantity  of  chemical  substance  determined  by  the  Secretary  to  be  potentially 
dangerous,  a  smaller  set  of  chemical  facilities  deemed  as  presenting  a  high  level  of 
security  risk.6  As  such,  chemical  facilities  with  greater  than  specified  quantities  of 
potentially  dangerous  chemicals  will  be  required  to  submit  information  to  DHS,  so 
that  DHS  can  determine  the  facility’s  risk  status. 

Those  facilities  identified  by  DHS  as  high  risk  will  have  additional 
responsibilities.  The  DHS  will  establish  a  series  of  risk-based  tiers  with  different 
performance-based  requirements  for  facilities  assigned  to  each  tier.  All  high-risk 
facilities  must  assess  their  vulnerabilities,  using  methodology  accepted  by  DHS; 
develop  an  effective  security  plan;  submit  these  documents  to  DHS;  and  implement 
the  security  plan.  Vulnerability  assessments  and  site  security  plans  developed 
through  alternative  security  programs  will  be  accepted  so  long  as  they  meet  the 
tiered,  performance-based  requirements  of  the  regulation.  In  turn,  DHS  will  approve 
or  disapprove  the  vulnerability  assessments,  the  site  security  plans,  and  their 
implementation  through  audit  and  inspection.  The  DHS  will  provide  certification  of 
the  facility’s  compliance  status.7 

The  vulnerability  assessment  will  serve  two  purposes  under  the  regulation.  One 
is  to  determine  or  confirm  the  placement  of  the  facility  in  a  risk-based  tier.  The  other 
is  to  provide  a  basis  against  which  to  compare  the  site  security  plan  activities.  The 
vulnerability  assessment  required  by  DHS  will  include  the  following  components: 


5  71  Federal  Register  78,27 6-7 8,332  (December  28,  2006). 

6  This  initial  screening  of  chemical  facilities  will  be  done  on  the  basis  of  potential 
consequence,  rather  than  risk.  7 1  Federal  Register  78,276-78,332  (December  28,  2006)  at 
78,302. 

7  Audit  inspections  may  be  conducted  by  third-party  auditors.  It  is  unclear  whether 
compliance  with  the  regulation  would  reduce  the  risk  status  of  the  chemical  facility,  since 
the  vulnerability  of  the  facility  would  presumably  decrease  and  vulnerability  is  a  factor  used 
to  determine  risk  status. 
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asset  characterization,  threat  assessment,  vulnerability  analysis,  risk  assessment,  and 
countermeasures  analysis.8 

The  site  security  plans  must  address  the  vulnerability  assessment  by  describing 
how  activities  in  the  plan  relate  to  facility  vulnerabilities.  Additionally,  the  site 
security  plan  must  address  preparations  for  and  deterrents  against  specific  modes  of 
potential  terrorist  attack,  as  applicable.  These  modes  of  attack  may  include  vehicle- 
borne  improvised  explosive  device;  water-borne  explosive  device;  ground  assault; 
or  other  modes  of  potential  attack  identified  by  DHS.9  The  site  security  plans  must 
also  address  how  the  activities  taken  by  the  facility  meet  the  risk-based  performance 
standards  provided  by  DHS. 

All  vulnerability  assessments  and  site  security  plans  are  to  be  submitted  to  DHS 
for  approval.  The  Secretary  may  disapprove  of  those  assessments  or  plans  that  fail 
to  meet  DHS  standards,  but  not  on  the  basis  of  the  presence  or  absence  of  a  specific 
measure.  In  the  case  of  disapproval,  DHS  must,  in  writing,  identify  those  areas  of  the 
assessment  and  plan  that  need  improvement.  Chemical  facilities  may  appeal 
disapprovals  to  DHS. 

The  information  generated  under  this  regulation,  as  well  as  any  information  that 
the  Secretary  determines  needs  to  be  protected,  will  be  labeled  “Chemical-terrorism 
Security  and  Vulnerability  Information”  (CVI),  a  new  category  of  security-related 
information.  According  to  its  proposal,  DHS  will  have  sole  discretion  regarding  who 
will  be  eligible  to  receive  CVI.10 

The  proposed  federal  regulation  will  preempt  state  and  local  regulation  where 
state  and  local  regulation  “conflicts  with,  hinders,  poses  an  obstacle  to  or  frustrates 
the  purposes  of’  the  federal  regulation.11  Specifically,  since  the  statute  underlying 
the  federal  regulation  prohibits  DHS  from  requiring  the  presence  or  absence  of  a 
particular  security  measure,  DHS  asserts  that  state  and  local  regulations  that  require 
the  presence  or  absence  of  a  particular  security  measure  will  be  preempted.12  States, 
localities,  or  affected  companies  may  request  a  decision  from  DHS  regarding 
potential  conflict  between  extant  regulation  and  the  federal  regulation. 

The  proposed  interim  regulations  establish  penalties  for  the  disclosure  of  CVI 
information  or  lack  of  compliance,  as  well  as  processes  for  appeal  by  chemical 
facilities  of  DHS  actions.  If  a  facility  remains  out  of  compliance  with  these 
regulations,  DHS  may  order  its  closure,  after  other  penalties,  such  as  fines,  have  been 
levied. 


8  71  Federal  Register  78,276-78,332  (December  28,  2006)  at  78,296. 

9  Id.  at  78,297. 

10  Audit  inspections  may  be  conducted  by  third-party  auditors.  It  is  unclear  what  criteria 
might  be  established  for  the  certification  of  such  third-party  auditors,  who  would  need  to 
have  access  to  CVI  for  those  facilities  being  audited. 

11  71  Federal  Register  78, 276-78,332  (December  28,  2006)  at  78,302. 

12  Id.  at  78,292-78,293. 
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Key  Issues 

Chemical  facility  security  was  the  focus  of  several  congressional  hearings  and 
policy  debates  surrounding  proposed  legislation  in  the  109lh  Congress,  legislation 
reported  by  the  House  Homeland  Security  Committee  and  the  Senate  Committee  on 
Homeland  Security  and  Governmental  Affairs.  Some,  but  not  all,  of  the  topics  that 
were  considered  contentious  were  addressed  by  P.L.  109-295.  This  section  will 
discuss  several  of  these  topics  in  light  of  the  enacted  provisions:  the  scope  of  the 
regulated  facilities,  inherently  safer  technology,  federal  preemption,  and  the 
protection  of  information. 

Scope  of  Regulated  Facilities 

The  universe  of  regulated  facilities  is  not  specified  in  P.L.  109-295  and  thus 
remains  potentially  an  issue  of  policy  debate.  Under  the  proposed  regulation, 
chemical  facilities 

shall  mean  any  facility  that  possesses  or  plans  to  possess,  at  any  relevant  point 
in  time,  a  quantity  of  a  chemical  substance  determined  by  the  Secretary  to  be 
potentially  dangerous  or  that  meets  other  risk-related  criterion  identified  by  the 
Department.13 

Regulated  facilities  are  a  subset  of  the  chemical  facility  universe,  including  any 
facility  that 

in  the  discretion  of  the  Secretary  of  Homeland  Security,  presents  a  high  risk  of 
significant  adverse  consequences  for  human  life  or  health,  national  security 
and/or  critical  economic  assets  if  subjected  to  terrorist  attack,  compromise, 
infiltration,  or  exploitation.14 

The  chemical  substances  determined  by  the  Secretary  to  be  potentially  dangerous 
were  not  reported  with  the  regulation.  Instead,  the  preamble  states, 

The  Department  may  draw  on  many  sources  of  available  information,  including 
existing  Federal  data  and  lists  addressing  particularly  hazardous  chemicals  and 
particular  chemical  facilities.  Such  lists  include  the  [Environmental  Protection 
Agency’s  Risk  Management  Program]  list ...;  the  schedule  of  chemicals  from  the 
Convention  on  the  Development,  Production,  Stockpiling  and  Use  of  Chemical 
Weapons  and  Their  Destruction,  also  known  as  the  Chemical  Weapons 
Convention  or  CWC  ...;  the  hazardous  materials  listed  in  Department  of 
Transportation’s  Hazardous  Materials  Regulations  (see  e.g.  49  CFR  172.101); 
and  the  [Transportation  Security  Administration’s]  Select  Hazardous  Materials 
List.  The  Department  may  also  seek  and  analyze  information  from  many  other 
sources,  including  from  experts  in  the  industry,  from  state  or  local  governments 
or  directly  from  facilities  that  may  qualify  as  high-risk. 15 


13  Id.  at  78,294. 

14  Id. 

15  Id.  at  78,28 1-78,282. 
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Depending  on  what  chemical  substances  the  DHS  Secretary  determines  are 
potentially  dangerous,  the  universe  of  chemical  facilities  may  be  small  or  large.16 
While  many,  if  not  most,  of  these  facilities  will  not  be  high-risk,  DHS  will  require 
all  of  these  chemical  facilities  to  complete  a  consequence-based  screening 
questionnaire  to  determine  their  risk  category.17  The  DHS  will  treat  facilities  not 
completing  such  a  questionnaire  as  presumptively  high-risk. 18  Such  an  approach  may 
tax  DHS  resources,  as  well  as  negatively  impact  small  businesses,  especially  during 
the  initial  screening  process.  Additionally,  depending  on  how  DHS  publicizes 
chemical  substance  and  quantity  requirements,  chemical  facilities  may  not  know 
whether  they  are  required  to  report  under  this  proposed  regulation. 

Inherently  Safer  Technology 

Considerable  congressional  debate  on  chemical  facility  security  revolved  around 
the  issue  of  inherently  safer  technology.  During  this  debate,  the  application  of 
inherently  safer  technology  as  a  risk-reducing  security  measure  was  generally 
supported  by  environmental  groups  and  opposed  by  industry  groups.  Environmental 
groups  proposed  that  reducing  the  inherent  consequences  from  a  release  at  a  chemical 
facility  would  increase  its  security,  as  the  incentive  to  attack  such  a  lower- 
consequence  facility  would  be  reduced.  Industry  groups  argued  that  chemical 
substance  and  technology  changes  were  business  and  safety  concerns,  not  related  to 
security  issues,  and  best  left  to  the  discretion  of  the  chemical  facility,  rather  than  the 
federal  government. 

Both  the  statute  and  the  regulation  are  silent  on  the  issue  of  inherently  safer 
technology.  Neither  recommend  nor  prohibit  the  use  of  inherently  safer  technology 
as  a  security  method,  assuming  that  it  contributes  to  meeting  the  risk-based 
performance  standards  put  forth  by  DHS.  The  risk-based  performance  standards 
appear  more  focused  on  hardening  facilities  than  on  consequence  mitigation 
techniques .  Alternatively,  use  of  inherently  safer  technology  may  reduce  the  quantity 
or  type  of  chemical  stored  on  site,  possibly  removing  the  chemical  facility  from 
regulation.  Both  the  statute  and  the  regulation,  in  establishing  risk-based 
performance  standards,  expressly  deny  requiring  any  specific  security  measure  from 
chemical  facilities. 


16  For  example,  the  list  of  hazardous  materials  in  the  Department  of  Transportation's 
Hazardous  Materials  Regulations  (49  CFR  172.101)  is  roughly  160  pages  long.  Also,  the 
universe  of  the  Environmental  Protection  Agency’ s  Risk  Management  Program,  a  program 
based  on  one  of  the  lists  cited  in  the  preamble,  is  approximately  15,000  facilities.  Some  of 
these  facilities  would  fall  within  the  statutory  exemptions  to  chemical  security  regulation. 

17  In  2005,  DHS  testified  that  approximately  3,400  chemical  facilities  were  considered  high- 
risk,  having  the  ability  impacting  1,000  or  more  people.  Testimony  of  Robert  B.  Stephan, 
Assistant  Secretary  for  Infrastructure  Protection,  Department  of  Homeland  Security,  before 
the  Senate  Committee  on  Homeland  Security  and  Governmental  Affairs  on  June  15,  2005. 
The  use  of  a  consequence  threshold,  as  is  proposed  in  the  initial  screening  procedure,  would 
likely  capture  all  high-risk  facilities  if  the  threshold  was  set  at  a  low  level.  That  tactic  might 
also  capture  many  non-high-risk  facilities. 

18  71  Federal  Register  78,276-78,332  (December  28,  2006)  at  78,282. 
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Federal  Preemption 

Another  area  of  congressional  debate  was  whether  federal  chemical  facility 
security  legislation  should  expressly  preempt  such  activities  on  the  state  level. 
Several  states  have  begun  to  enact  security  regulations  for  chemical  facilities.19 
Supporters  of  express  federal  preemption  assert  that  a  patchwork  of  state  regulation 
provides  a  competitive  disadvantage  to  companies  on  a  state -by-state  basis  and  may 
lead  to  uneven  security  efforts.  Opponents  of  express  federal  preemption  claim  that 
federal  security  regulation  should  set  a  floor,  rather  than  a  ceiling,  for  security  efforts ; 
individual  states  should,  in  their  opinion,  be  allowed  to  require  additional  security 
measures,  so  long  as  the  federal  standard  is  surpassed. 

The  statute  was  silent  with  respect  to  preemption,  but  the  proposed  regulation 
is  not.  The  DHS  asserts  that  statutory  limits  placed  on  the  form  of  the  federal 
regulation  should  be  met  by  any  state  regulation.  Specifically,  according  to  DHS,  the 
balance  struck  by  P.L.  109-295  between  DHS  security  requirements  and  a  facility’s 
flexibility  to  choose  specific  security  measures  must  be  preserved.  The  preamble  to 
the  rule  provides,  “A  state  measure  frustrating  this  balance  will  be  preempted.”20 

According  to  the  statute,  “the  Secretary  may  not  disapprove  a  Site  Security  Plan 
submitted  under  this  section  based  on  the  presence  or  absence  of  a  particular  security 
measure.”21  The  federal  chemical  facility  security  regulation  thus  does  not  require 
the  application  or  use  of  any  particular  security  measure.  The  proposed  interim  rule 
then  seems  to  imply  that  any  state  regulation  that  does  require  a  specific  security 
measure  would  be  preempted,  because  it  “conflicts  with,  hinders,  poses  an  obstacle 
to  or  frustrates  the  purposes  of  these  regulations  or  of  any  approval,  disapproval  or 
order  issued  thereunder.”  22  If  this  proposed  language  is  retained  in  the  interim  final 
rule,  it  seems  likely  that  any  existing  prescriptive  state  regulations,  such  as  those  in 
New  Jersey,  would  be  preempted  by  the  performance-based  federal  regulation.23 


19  New  Jersey,  arguably  the  state  with  the  most  stringent  chemical  security  regulations, 
requires  the  consideration  of  inherently  safer  technology  as  a  component  of  a  facility’s 
security  plan. 

20  71  Federal  Register  78,276-78,332  (December  28,  2006)  at  78,293. 

21  DHS  Appropriations  Act,  supra  note  1  at  §  550(a). 

22  71  Federal  Register  78,276-78,332  (December  28,  2006)  at  78,302. 

23  For  a  legal  analysis  of  preemption  and  a  discussion  of  DHS’s  authority  to  preempt  state 
law  by  administrative  action,  see  Legal  Analysis  of  the  Preemption  Provisions  in  the  Recent 
Department  of  Homeland  Security's  Chemical  Facility  Security  Advance  Notice  of 
Rulemaking,  Cong.  Dist.  Memo.,  by  Todd  B.  Tatelman  (January  23,  2007)  (available  from 
authors  upon  request). 
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Information  Availability 

Another  issue  that  generated  considerable  congressional  interest  and  debate  was 
how,  and  to  what  extent,  the  information  created  by  chemical  facilities  and  submitted 
to  DHS  is  to  be  protected  from  disclosure  to  the  public,  industry  competitors,  and 
potential  bad  actors.  The  Freedom  of  Information  Act  (FOIA),  which  generally 
applies  to  records  held  by  agencies  of  the  executive  branch  of  the  federal 
government,  regulates  the  disclosure  of  government  information.24  The  FOIA 
requires  agencies  to  publish  in  the  Federal  Register  certain  records,  and  to  make 
other  records  available  for  public  inspection  and  copying.25 

While  the  FOIA  contains  three  specific  law  enforcement  related  exclusions  and 
nine  exemptions  that  permit  the  withholding  of  certain  government-held  information, 
it  has  been  the  prevailing  view  since  September  11,  2001,  that  separate  federal 
statutes  prohibiting  the  disclosure  of  certain  types  of  information,  and  authorizing  its 
withholding  under  the  FOIA,  are  necessary.  As  a  result,  several  security-related 
information  protection  statutes  have  been  adopted  by  Congress  and  implemented  by 
the  government.  Of  specific  relevance  to  chemical  facilities  is  the  protection  regime 
known  as  “Sensitive  Security  Information”  (SSI),  currently  used  by  the 
Transportation  Security  Administration  in  enforcing  the  Maritime  Transportation 
Security  Act  of  2002  (MTS A). 26 

Section  550(c)  of  P.L.  109-295  contains  two  specific  mandates  regarding 
information  protection.  The  first  mandate  requires  that 

information  developed  under  this  section,  including  vulnerability  assessments, 
site  security  plans,  and  other  security  related  information,  records,  and 
documents  shall  be  given  protections  from  public  disclosure  consistent  with 
similar  information  developed  by  chemical  facilities  subject  to  regulation  under 
[MTS  A], 27 

The  reference  to  MTSA  is  considered  to  be  a  reference  to  SSI,  which  is  the 
information  protection  regime  developed  and  administered  by  the  Transportation 
Security  Administration,  and  applicable  to  maritime  facilities  regulated  under  MTSA. 

The  DHS’ s  proposed  chemical  facility  security  regulations  expressly  recognize 
the  reference  to  SSI;  however,  instead  of  amending  the  existing  SSI  regulations  to 
include  application  to  chemical  facilities,  DHS  has  proposed  a  new  security- 
information  protection  regime,  “Chemical-Terrorism  Security  and  Vulnerability 


24  5  U.S.C.  §  552  et  seq.  (2000). 

25  See  id.  at  §  552(a)(l)-(2). 

26  While  initially  created  for  the  Department  of  Transportation  in  1974,  SSI  has  been 
significantly  expanded  by  the  Aviation  Transportation  Security  Act  of  2001  (ATSA),  the 
Homeland  Security  Act  of  2002,  and  the  Maritime  Transportation  Security  Act  of  2002.  See 
CRS  Report  RL33670,  Protection  of  Security-Related  Information ,  by  Gina  Marie  Stevens 
and  Todd  B.  Tatelman  (providing  an  in-depth  discussion  of  the  history,  requirements,  and 
litigation  that  has  developed  under  SSI). 

27  DHS  Appropriations  Act,  supra  note  1  at  §  550(c). 
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Information”  (CVI).  According  to  DHS,  information  classified  as  CVI  is  to  receive 
“a  level  of  security  not  inconsistent  with  that  provided  to  SSL  Yet  the  Department 
believes  that  Section  550(c)  provides  it  with  broad  discretion  and  maximum 
flexibility  to  employ  more  rigorous  standards  to  protect  CVI  from  inappropriate 
public  disclosure  as  necessary.”28 

The  DHS ’s  proposed  regulations  provide  that  the  following  types  of  information 
will  constitute  CVI:  (1)  vulnerability  assessments;  (2)  site  security  plans;  (3)  any 
documents  developed  relating  to  the  Department’s  review  and  approval  of 
vulnerability  assessments  and  security  plans;  (4)  alternate  security  plans;  (5) 
documents  relating  to  inspection  or  audits;  (6)  any  records  required  to  be  created  or 
retained  under  these  regulations;  (7)  sensitive  portions  of  orders,  notices  or  letters 
(8)  information  developed  to  determine  the  risk  posed  by  chemical  facilities,  or  to 
determine  which  facilities  are  “high  risk;”  and  (9)  any  other  information  that  the 
Secretary,  in  his  discretion,  determines  warrants  the  protections  set  forth  in  this  part.29 

The  proposed  regulations  state  that  “covered  persons”  must  “[djisclose,  or 
otherwise  provide  access  to,  CVI  only  to  covered  persons  who  have  a  need  to  know, 
unless  otherwise  authorized  in  writing  by  the  Secretary  of  DHS.”30  The  term 
“covered  persons”  is  defined  by  the  proposed  rules  as:  persons  who  have  access  to 
CVI;  persons  receiving  CVI  in  the  course  of  administrative  proceedings  or  litigation; 
and  as  persons  who  otherwise  receive  access  to  “what  they  know  or  reasonably 
should  know  constitutes  CVI.”31  Persons  with  the  “need  to  know,”  according  to  the 
proposed  rule,  are  categorized  in  6  ways:  (1)  persons  who  require  access  to  carry  out 
activities  approved  or  sanctioned  by  DHS;  (2)  persons  who  require  access  to  train  for 
DHS  approved  or  sanctioned  activities;  (3)  persons  required  to  supervise,  manage, 
or  otherwise  oversee  DHS  approved  or  sanctioned  activities;  (4)  persons  who  require 
the  information  for  the  purposes  of  providing  technical  or  legal  advice;  (5)  persons 
who  are  representing  a  covered  person  in  either  an  administrative  or  judicial 
proceeding;  and  (6)  when  DHS  determines  access  is  required  in  an  administrative  or 
judicial  proceeding.32 

Also  of  note  in  the  proposed  regulations  is  the  possibility  that  access  to  CVI  may 
be  contingent  upon  completion  of  a  background  or  other  security  check.  The 
proposed  rule  indicates  that  DHS  may  “make  an  individual’s  access  to  the  CVI 
contingent  upon  satisfactory  completion  of  a  security  background  check  or  other 
procedures  or  requirements  for  safeguarding  CVI  that  are  satisfactory  to  DHS.”33 
Finally,  the  proposed  regulations  provide  DHS  with  discretionary  authority  to  further 
limit  access  to  CVI,  even  if  persons  otherwise  meet  the  required  qualifications.  The 
regulations  state  that  “[f]or  some  specific  CVI,  DHS  may  make  a  finding  that  only 


28  71  Federal  Register  78,276-78,332  (December  28,  2006)  at  78,288. 

29  Id.  at  78,300. 

30  Id. 

31  Id. 

32  Id.  at  78,300-301. 

33  Id.  at  78,301. 
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specific  persons  or  classes  of  persons  have  a  need  to  know.”34  It  is  unclear  from  this 
language  in  what  circumstances,  or  by  what  standards,  DHS  will  issue  such  findings. 

The  second  mandate  contained  in  P.L.  109-295  states  that: 

in  any  proceeding  to  enforce  this  section,  vulnerability  assessments,  site  security 
plans,  and  other  information  submitted  to  or  obtained  by  the  Secretary  under  this 
section,  and  related  vulnerability  or  security  information,  shall  be  treated  as  if  the 
information  were  classified  material.35 

The  terms  “classified  material”  or  “classified  information”  have  been  defined  in 
several  different  contexts.  Congress  has  statutorily  defined  “classified  material”  as 
“[a]ny  information  or  material  that  has  been  determined  by  the  United  States 
government  pursuant  to  an  Executive  Order,  statute,  or  regulation,  to  require 
protection  against  authorized  disclosure  for  reasons  of  national  security....”36 
Executive  Orders  have  defined  “classified  information”  as  “information  that  ... 
require[s]  protection  against  unauthorized  disclosure  and  is  marked  to  indicate  its 
classified  statutes  when  in  documentary  form.”37  In  addition,  according  to  Executive 
Order,  “classified  information”  may  include  anything  that  the  original  classifying 
authority  determines  that  “reasonably  could  be  expected  to  result  in  damage  to 
national  security,  which  include[s]  defense  against  transnational  terrorism,  and  the 
original  classification  authority  is  able  to  identify  and  describe  the  damage.”38 

As  a  result  of  this  congressional  mandate  and  the  nature  of  the  information  at 
issue,  DHS  has  indicated  that  in  administrative  proceedings  and  litigation  before 
courts,  CVI  will  only  be  disclosed  under  the  narrowest  of  parameters  consistent  with 
Executive  Orders  and  other  congressional  enactments.  In  administrative  proceedings, 
DHS  proposes  that  CVI  only  be  disclosed  at  the  Secretary’s  sole  discretion  and  only 
when  it  “is  necessary  for  the  person  to  prepare  a  response  to  allegations  contained  in 
a  legal  enforcement  action  document  issued  by  DHS.”39  Even  in  such  a 
circumstance,  DHS  reserves  the  right  to  require  the  requesting  person  or  entity  to 
undergo  and  satisfy  a  security  background  check  before  receiving  the  information.40 

Similarly,  in  litigation  arising  out  of  enforcement  actions,  whether  civil  or 
criminal,  DHS  has  proposed  a  system  of  applicable  procedures  akin  to  those 
contained  in  both  the  Classified  Information  Protection  Act,41  and  at  18  U.S.C.  § 
2339B.  For  example,  DHS’s  proposal  would  permit  reviewing  courts,  after  an 


34  Id. 

35  DHS  Appropriations  Act,  supra  note  1  at  §  550(c). 

36  Classified  Information  Procedures  Act,  P.L.  96-456,  94  Stat.  2025  (1980)  (codified  as 
amended  at  18  U.S.C.  App.  3  §§  1-16  (2000))  [hereinafter  CIPA], 

37  Exec.  Order  No.  12,958  §  6.1(h),  60  Fed.  Reg.  19,825  (April  20.  1995). 

38  Exec.  Order  No.  13,292  §1. 1(a)(4),  68  Fed.  Reg.  15,315  (March  28,  2003). 

39  See  71  Federal  Register  78,276-78,332  (December  28,  2006)  at  78,276  and  78,301 . 

40  Id. 

41  See  CIPA,  supra  note  36. 
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opportunity  to  independently  view  the  documents,  to  authorize  one  of  the  following 
as  a  substitute  for  CVI  sought  in  discovery:  (1)  A  redacted  version  of  the  CVI 
documents;  (2)  a  summary  of  the  information  contained  in  the  CVI  documents;  or  (3) 
a  statement  admitting  relevant  facts  that  the  CVI  documents  would  tend  to  prove. 
The  DHS’s  proposal  also  provides  protections  against  the  disclosure  of  CVI  through 
live  witness  testimony.42  Moreover,  in  the  event  that  the  Government  objects  to  a 
witness’s  testimony,  the  regulations  authorize  the  court  to  consider  an  ex  parte 
proffer  by  the  Government  on  what  the  witness  is  likely  to  say  as  well  as  a  proffer 
from  the  defendant  of  the  nature  of  the  information  sought.43  Further,  DHS’s 
proposal  would  permit  the  Department  to  immediately  appeal  if  a  court  denies  any 
request  related  to  the  disclosure  of  CVI.44  Finally,  DHS’s  proposal  expressly  states 
that  no  CVI  will  be  provided  in  any  civil  litigation  unrelated  to  the  enforcement  of 
Section  550.45 

Expiration  of  Regulations  and  Authority 

The  meaning  of  the  expiration  provision  of  P.L.  109-295  appears  to  be  the 
subject  of  some  uncertainty.  The  statute  specifically  states  that: 

Interim  regulations  issued  under  this  section  shall  apply  until  the  effective  date 
of  interim  or  final  regulations  promulgated  under  other  laws  that  establish 
requirements  and  standards  referred  to  in  subsection  (a)  and  expressly  supercede 
this  section.  Provided,  That  the  authority  provided  by  this  section  shall  terminate 
three  years  after  the  date  of  enactment  of  this  Act.46 

In  the  preamble  to  DHS’s  proposed  regulations  the  Department  suggests  that 
notwithstanding  the  plain  text  of  the  statute,  should  future  funds  be  appropriated  by 
Congress,  even  in  the  absence  of  an  authorizing  statute,  the  regulations  and  the 
authority  to  enforce  them  would  continue  as  though  sufficiently  authorized.47 

As  a  general  rule,  there  is  no  specific  statutory  or  other  legal  reguirement  that 
appropriations  be  preceded  by  specific  authorizations.  As  a  result,  Congress  may, 
subject  to  possible  procedural  points  of  order,48  appropriate  funds  for  programs  that 
exceed  the  scope  and/or  duration  of  a  prior  authorization.  In  instances  where 


42  See  71  Federal  Register  78,276-78,332  (December  28,  2006)  at  78,301. 

43  Id. 

44  Id. 

45  Id. 

46  DHS  Appropriations  Act,  supra  note  1  at  §  550(b). 

47  See  71  Federal  Register  78,276-78,332  (December  28,  2006)  at  78,276  and  78,281 
(stating  that  “[i]f  a  future  appropriations  bill  continued  funding  for  the  Section  550  program 
beyond  that  period,  the  Department  could  consider  that  future  funding  for  the  program  as 
an  extension  of  the  ‘authority  provided  by  this  section.’”). 

48  Rule  XXI(2)  of  the  Rules  of  the  House  of  Representatives  prohibits  appropriations  for 
objects  not  previously  authorized  by  law.  A  similar,  but  more  limited,  prohibition  exists  in 
Rule  XVI  of  the  Standing  Rules  of  the  Senate.  Each  of  these  provisions  must  be  raised  via 
a  “point  of  order,”  which  may  be  overcome  by  a  super-majority  vote  in  each  chamber. 
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Congress  has  opted  for  this  type  of  action,  the  enacted  appropriation  has  been 
interpreted  by  the  Comptroller  General  to,  in  effect,  carry  with  it  its  own 
authorization  and,  therefore,  is  to  be  available  to  the  agency  for  obligation  and 
expenditure.49  In  addition,  the  Comptroller  General  has  also  held  that,  as  a  general 
proposition,  the  appropriation  of  funds  for  a  program  whose  funding  authorization 
has  expired,  or  is  about  to  expire  during  the  period  of  availability  of  the  appropriation 
(e.g.,  authorization  expires  during  a  fiscal  year  for  which  money  has  already  been 
appropriated),  provides  sufficient  legal  basis  to  continue  a  program  during  that  period 
of  availability,  even  when  expressed  congressional  intent  appears  to  be  contrary.50 
Given  these  general  rules,  it  would  appear  that  should  Congress  appropriate  funds  to 
DHS  for  the  purpose  of  continuing  to  secure  chemical  facilities,  even  after  the 
expiration  of  the  Section  550  authorization,  sufficient  legal  authority  would  exist  for 
the  regulations  to  remain  in  effect. 


Policy  Options 

Reaction  to  the  proposed  regulation  has  been  mixed.  Some  policymakers  and 
advocates  have  criticized  the  approach  taken  by  DHS.  Others  have  been  supportive 
of  the  proposed  regulation.  As  written,  the  law  anticipates  further  legislative  activity 
in  this  area.  Policymakers  may  decide  to  wait  and  observe  how  the  final  interim 
regulation  is  promulgated  and  implemented,  attempt  to  influence  DHS’s  final 
regulation  or  implementation,  or  legislate  to  alter  or  supersede  the  enacted  legislation. 

Maintain  Status  Quo 

The  authority  to  federally  regulate  chemical  facility  security  is  new.  As  such, 
regulation  in  this  area  may  need  time  to  mature.  Congress,  when  passing  P.L.  109- 
295,  contemplated  the  eventual  supersession  of  these  regulations: 

Interim  regulations  issued  under  this  section  shall  apply  until  the  effective  date 
of  interim  or  final  regulations  promulgated  under  other  laws  that  establish 
requirements  and  standards  referred  to  in  subsection  (a)  and  expressly  supersede 
this  section:  Provided,  [t]hat  the  authority  provided  by  this  section  shall 
terminate  three  years  after  the  date  of  enactment  of  this  Act.51 

Policymakers  may  view  this  regulatory  authority,  and  thus  these  regulations,  as  a 
stop-gap  measure,  providing  a  temporary  solution  to  the  perceived  chemical  security 
problem,  with  the  intent  of  allowing  the  security  policy  debate  to  further  mature.  In 
this  case,  policymakers  may  decide  to  wait,  allowing  DHS  to  promulgate  and 
implement  its  proposed  regulation  before  considering  changes  in  chemical  facility 
security  policy.  This  might  more  fully  reveal  the  impacts  of  the  current  regulation. 


49  See  67  Comp.  Gen.  401  (1988). 

50  See,  e.g.,  65  Comp.  Gen.  524  (1986);  65  Comp.  Gen.  318,  320-21  (1986);  55  Comp.  Gen. 
289(1975). 

51  DHS  Appropriations  Act,  supra  note  1  at  §  550. 
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Attempt  to  Influence  Implementation 

The  statutory  language  of  P.L.  109-295,  Section  550  grants  significant  discretion 
to  the  DHS  Secretary.  The  interpretation  and  application  of  this  discretion  by  the 
DHS  Secretary,  particularly  in  the  areas  of  information  protection  and  state 
preemption,  is  the  source  of  some  of  the  criticisms  levied  against  the  proposed 
regulations.52  While  discretionary  authority  may  be  important  to  the  effective  and 
efficient  implementation  of  a  regulatory  structure,  policymakers  may  believe  that 
execution  of  this  discretionary  authority  has  been  counter  to  congressional  intent. 
Policymakers  may  decide  to  influence  the  manner  in  which  the  DHS  Secretary’s 
discretion  is  applied. 

The  DHS  has  requested  public  comment  from  interested  parties  on  questions, 
issues,  and  the  proposed  regulatory  language.53  As  such,  the  comments  of 
policymakers,  advocates  and  interested  parties  may  influence  the  form  and  language 
of  the  interim  final  regulation.  Through  providing  comments  to  the  docket, 
policymakers  may  express  support  for  and  criticism  of  the  proposed  regulations  and 
possible  policy  solutions  to  perceived  regulatory  problems.  The  docket  for  the 
proposed  regulation  closes  on  February  7,  2007,  and  the  interim  final  regulation  is 
projected  to  be  promulgated  in  April  2007. 

Once  the  interim  final  regulation  is  promulgated,  policymakers  may  conclude 
they  are  dissatisfied  with  the  form  of  the  final  regulations.  If  this  is  the  case, 
policymakers  could  act  to  more  explicitly  describe  and  limit  the  discretionary  scope 
granted  to  the  DHS  Secretary.  They  may  influence  the  regulations’  implementation 
through  the  congressional  oversight  process  by  clarifying  congressional  intent, 
through  hearings  on  the  regulation’s  implementation,  or  through  language  added  to 
DHS  appropriations  legislation. 

Another  option  would  be  for  Congress  to  invoke  the  Congressional  Review  Act 
(CRA).54  The  CRA  establishes  an  expedited  mechanism  by  which  Congress  can 
review  and  disapprove  final  federal  agency  rules.55  Since  its  enactment,  however,  the 
CRA  has  been  successfully  used  only  once.  If  the  final  rule  is  successfully 
disapproved  under  the  CRA,  DHS  would  be  prohibited  from  promulgating  a  similar 
rule  absent  an  express  authorization  from  Congress. 


52  John  Heilprin,  “Chemical  Plants  to  Submit  Security  Plans,”  Associated  Press,  December 
22,  2006;  Greg  Gordon,  “New  Rules  Aim  to  Protect  Chemical  Plants  from  Terrorists,”  San 
Jose  Mercury  News,  December  22,  2006. 

53  71  Federal  Register  78,27 6-78,332  (December  28, 2006)  at  78,277.  An  electronic  docket 
for  this  proposed  regulation  is  established  at  [http://www.regulations.gov]  under  docket 
identifications  number  DHS-2006-0073.  Electronic  comments  may  be  submitted  before 
February  7,  2007  or  generally  read  under  this  docket  number. 

54  Small  Business  Regulatory  Enforcement  Fairness  Act  of  1996,  P.L.  104-121. 

55  See  CRS  Report  RL31 160,  Disapproval  of  Regulations  by  Congress:  Procedure  Under 
the  Congressional  Review  Act,  by  Richard  S.  Beth. 
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Create  New  Legislation 

Policymakers  may  decide  that  additional  legislation  is  necessary  in  the  chemical 
facility  security  area.  Such  legislation  could  be  targeted  in  nature,  attempting  to 
remedy  perceived  flaws  by  slightly  altering  the  existing  authorities  granted  to  DHS, 
or  more  comprehensive.  A  more  comprehensive  approach  may  occasion  substantive 
changes  in  the  existing  authorities  and  thus  extensive  revision  of  any  chemical 
facility  security  regulation. 

Policymakers  may  ultimately  decide  that  the  regulatory  structure  proposed  by 
DHS  does  not  satisfy  homeland  security  needs  or  will  prove  too  onerous  to  industry 
and  opt  to  enact  new  chemical  facility  legislation.  Such  legislation  might  expand  the 
reach  of  the  proposed  regulatory  structure,  for  example,  by  mandating  the  inclusion 
of  particular  chemical  substances  as  potentially  dangerous;  restrict  the  proposed 
regulations,  for  example,  by  lowering  regulatory  burdens  or  requirements  on  small 
businesses;  or  direct  the  agency  to  include  or  exclude  particular  components  from  its 
regulations. 

Developing  new  legislation,  or  changing  existing  legislation,  to  change  DHS 
regulation  may  bring  additional  costs,  especially  to  facilities  that  have  already  come 
into  compliance.  If  new  regulations,  established  under  new  or  amended  authority, 
present  new  requirements  for  chemical  facilities,  security  efforts  enacted  under  the 
original  regulation  may  not  be  entirely  applicable.  Chemical  facilities  may  be 
required  to  invest  in  additional  security  measures  to  meet  these  new  requirements, 
potentially  incurring  further  cost.  When  considering  whether  to  enact  new  legislation 
or  amend  existing  law,  policymakers  may  opt  to  consider  methods  to  mitigate 
additional  costs  to  chemical  facilities  that  have  already  complied  with  the  proposed 
regulation.  Considering  the  initial  statute  had  a  three-year  sunset  provision,  Congress 
may  have  intended  that  future  legislation  build  upon  P.L.  109-295,  Section  550,  so 
that  future  regulations  would  be  harmonized  with  the  interim  final  regulations 
initially  promulgated. 


